The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based...
Vulnerability Description
The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting sounds at similar frequencies as the device, disrupting the smartphone microphone’s ability to accurately read the data. To carry out this attack, the attacker must be close (less than 5 feet) to pick up and emit sound waves.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-41627
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Carlos Cilleruelo Rodríguez
- Javier Junquera Sánchez
Affected Vendor
AliveCor
View all reports →